-
Notifications
You must be signed in to change notification settings - Fork 2
/
readme.en.tex
346 lines (249 loc) · 26 KB
/
readme.en.tex
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
\documentclass[letterpaper,14pt]{article}
%xelatex shit
\usepackage{fontspec}
\usepackage{unicode-math}
\setmainfont{Ubuntu}
\setromanfont{DejaVu Serif}
\setsansfont{DejaVu Sans}
\setmonofont{Fira Code}
%\setmathfont{Cambria Math}
\setmathfont{STIX Math}
\defaultfontfeatures{Mapping=tex-text}
\usepackage{xunicode}
\usepackage{xltxtra}
\usepackage{polyglossia}
\setmainlanguage{english}
%end of xelatex shit
\usepackage{geometry,amsmath,amssymb,graphicx,smartref,float,tocloft,appendix,multirow,subcaption,listings,epsfig,endnotes, csquotes}
\usepackage[textsize=tiny,obeyDraft]{todonotes}
\usepackage{titletoc}
\pagestyle{myheadings}
\usepackage{algorithm}
\usepackage{algpseudocode}
\usepackage{url}
\usepackage{cleveref}
\usepackage[colorlinks, pdfusetitle]{hyperref}
\usepackage{hyperxmp}
\usepackage[backend=bibtex, sorting=none]{biblatex}
\usepackage[nottoc,numbib]{tocbibind}
\usepackage{attachfile2}
\attachfilesetup {
color=blue
}
\def\fpResultFile#1#2#3{
\attachfile[mimetype=application/json, subject=#1, description=#1, author=#2]{./results/#2/#3}
}
\lstloadlanguages{JavaScript}
\def\fpResultListing#1#2#3{
\lstinputlisting[caption="#1",language=JavaScript,basicstyle=\ttfamily,]{"./results/#2/#3"}
\fpResultFile{#1}{#2}{#3}
}
\geometry{left=30mm, right=20mm}
\lstset{breaklines=true, breakatwhitespace=true, extendedchars=true, numbers=left}
\hypersetup{
pdfinfo={
Subject={Bypassing TBB's protection for font canvas fingerprinting},
Title={Bypassing TBB's protection for font canvas fingerprinting},
Url={https://gitlab.com/KOLANICH1/Article-2015-Dull-captaincy-or-the-way-Tor-Project-fights-browser-fingerprinting},
Year={2014-2015},
Licenseurl={https://creativecommons.org/licenses/by-sa/4.0/},
Keywords={{JavaScript}, {HTML}, {information security}, {anonymity}, {Tor}, {TAILS}, {Whonix}, {fingerprinting}, {canvas}, {privacy}, {attacks}, {fingerprints}, {deanonymization}},
},
pdflang={en},
urlcolor={blue},
pdfstartview={FitH},
pdfpagemode={UseOutlines},
}
\usepackage[type={CC},modifier={by-sa},version={4.0}]{doclicense}
\addbibresource{bibliography.bib}
\begin{document}
\title{Dull \href{https://encyclopediadramatica.rs/Captain_Obvious}{captaincy} or the way Tor Project fights browser fingerprinting}
\author{\href{https://gitlab.com/KOLANICH1}{KOLANICH}}
\date{2015-01-15}
\maketitle
\begin{abstract}\label{abstract}
In this article we have successfully bypassed Tor Browser Bundle's protection against canvas fingerprinting, tested how it worked in different environments where both fingerprint stability and sensitivity to the environment was observed and discussed some aspects of fingerprinting, JavaScript, online tracking and Tor Browser Bundle.\\
\emph{\href{https://xkcd.com/}{Warning}}: this article occasionally contains informal style (which can be unsuitable for spoilsports), conspiracy theories (which can be unsuitable for conspiracy theorists), and JSON-serialized data (which can be unsuitable for aesthetes).
\end{abstract}
\doclicenseThis
\newpage
\tableofcontents
\newpage
In the article \cite{MS12} written by well-known among some folks \href{https://cseweb.ucsd.edu/~hovav/papers.html}{Hovav Shacam} and \href{https://cseweb.ucsd.edu/~kmowery/}{Keaton Mowery} a new (by the date) JavaScript\footnote{A programming language widely used in the Web (and not only in the Web)}-based browser fingerprinting\cite{Eckersley2010} method was described. It got the name ``Canvas Fingerprinting''. The method was powerful enough to distinguish between different hardware\ldots{}
\section{The article}\label{the-article}
The method was based on the fact that different browsers in different environments render text (and not only text) differently, because they rely on a large quantity of different modules of different levels which can have different settings and use different options of components of underlying level.
\begin{enumerate}
\itemsep1pt\parskip0pt\parsep0pt
\item
The fonts can have different glyphs, different sets of chars and different features used;
\item
library functions can be invoked using different parameters;
\item
different versions of \href{https://www.freetype.org/}{libfreetype}\footnote{`FreeType is a software font engine that is designed to be small, efficient, highly customizable, and portable while capable of producing high-quality output (glyph images).'} or other rendering libraries can be used;
\item
different OSes with different settings can render text differently (for example, \href{https://habr.com/post/247703/}{different versions of ClearType\texttrademark\footnote{a technology of subpixel font antialiasing}} or different screen resolution);
\item
different graphics drivers;
\item
different graphics hardware;
\end{enumerate}
The method from the article used the API \href{https://developer.mozilla.org/en-US/docs/Web/API/CanvasRenderingContext2D.getImageData}{getImageData}, which returns pixels of a rendered picture. Also, they used WebGL\footnote{OpenGL for the Web} rendering because different environments produce different pictures.
The authors have recommended using the software rendering without using OS and other software components installed into the system to produce the picture, adding some random noise and other means of protection. Tor Project has ``fixed'' canvas fingerprinting by asking the user's permission for returning real picture from getImageData and replacing random fonts to fallback-font on each page reload (that's why we are making 10 measurements).
\section{Defective by design}\label{defective-by-design}
There are other APIs, leaking information, which are (certainly!) not protected. For example, the text measuring API. If text is rendered differently, it means its sizes must be slightly different. Let's check this hypothesis using canvas \href{https://developer.mozilla.org/en-US/docs/Web/API/CanvasRenderingContext2D.measureText}{measureText} API and DOM \href{https://developer.mozilla.org/en-US/docs/Web/API/Element.getBoundingClientRect}{getBoundingClientRect} API.
You can contribute, to do it you need to clone\footnote{\lstinline!git clone https://gitlab.com/KOLANICH1/Article-2015-Dull-captaincy-or-the-way-Tor-Project-fights-browser-fingerprinting.git!} \href{https://gitlab.com/KOLANICH1/Article-2015-Dull-captaincy-or-the-way-Tor-Project-fights-browser-fingerprinting}{the repo}, download and run the latest (or any other) \href{https://www.torproject.org/download/download.html.en}{TBB}\footnote{Tor Browser Bundle, a set of programs for anonymous web surfing}, open the HTML file from the repo, and \textbf{to post your result as a comment or pull request}. Also, you can visit \href{https://jsfiddle.net/fyw4qmdg/5/}{a fiddle} or a \href{https://fiddle.jshell.net/fyw4qmdg/5/show/}{full-window fiddle}. Of course, we could not use hashes, this would have given ad more possibilities to mine the data, but even a compressed set of information about every font takes a lot of storage. It is not an issue for storage-enabled browsers, but is if we have to use cookies\footnote{a technology allowing to save small amounts (4097 bytes in most of browsers) of data which will be sent to server on any http request} instead. That's why we use \href{https://en.wikipedia.org/wiki/BLAKE_%28hash_function%29}{Blake2} hashes. \href{https://github.com/dchest/blake2s-js}{The implementation used} is by dchest.
Should be noted that some time after release of this paper I have found the study\cite{Fifield2015} with analysis of entropy of fonts and characters acquired in the method similar to the one used this study.
\section{The results}\label{the-results}
\subsection{Different browsers}\label{different-browsers}
At first I ran Firefox of stable and nightly versions on the same system.
\fpResultListing{Firefox 35.0 and Firefox Nightly 37.0a1 on Windows\texttrademark\ 8.1}{KOLANICH}{FF 35.0 37.0a1 @ Win 8.1.json}
The results were the same for both. What about Windows\texttrademark\ Se7en?
\fpResultListing{Firefox 35.0 on Windows\texttrademark\ 7}{KOLANICH}{FF 35.0 @ Win 7.json}
They are different.
Let's try to switch the parameters and look how they affect it. Changing ClearType\texttrademark\ prefs did nothing, so does switching DirectWrite, but enabling e10s\footnote{electrolysis, \href{https://wiki.mozilla.org/Electrolysis}{a project for making Firefox multiprocess}, as Chromium\texttrademark\ is} has changed the fingerprint (and broken page rendering: all pages had been seen as a black rectangle).
\fpResultListing{Firefox Nightly 37.0a1 with e10s enabled on Windows\texttrademark\ 8.1}{KOLANICH}{FF 37.0a1 e10s @ Win 8.1.json}
\fpResultListing{Chrome\texttrademark\ 39.0.2171.95 on Windows\texttrademark\ 8.1}{KOLANICH}{Chrome 39.0.2171.95 @ Win 8.1.json}
Also, \href{https://habr.com/users/starius/}{@starius} the \href{https://habr.com/}{Habr} (then GeekTimes) user \href{https://habr.com/post/356632/\#comment_8227810}{has published his results}.
\fpResultListing{IceWeasel on GNU/Linux\texttrademark\ by @starius}{results/starius/IW @ Linux.json}
Android is not forgotten
\fpResultListing{Firefox on CyanogenMod 11 Nightly}{KOLANICH}{FF @ CM11.json}
\subsection{Tor Browser Bundle}\label{tor-browser-bundle}
The fingerprint made on TBB of the version A at Win 8.1 is PARTIALLY the same that the fingerprint for Firefox Nightly with e10s enabled. Particularly the fingerprints for Courier New, Georgia and System fonts are different.
\fpResultListing{TBB version A on Win 8.1}{KOLANICH}{TBB, TAILS, Whonix/TBB A @ Win 8.1.json}
Let's try on another Win XP-based system.
\fpResultListing{TBB version A on Win XP}{KOLANICH}{TBB, TAILS, Whonix/TBB A @ Win XP.json}
Let's try another TBB version in the same environment.
\fpResultListing{TBB version B on WinXP with browser.display.use\_document\_fonts=1 (the default settings)}{KOLANICH}{TBB, TAILS, Whonix/TBB B @ Win XP.json}
Then I have disabled fonts rendering using \href{about:config}{\url{about:config}} preference \lstinline!browser.display.use_document_fonts!.
\fpResultListing{TBB version B in WinXP with browser.display.use\_document\_fonts=0 (the default value)}{KOLANICH}{TBB, TAILS, Whonix/TBB B (browser.display.use_document_fonts=0) @ Win XP.json}
It was observed that in this case an adversary only can extract the information about fallback font.
\href{https://habr.com/post/356632/\#comment_8227810}{The partial results} by \href{https://habr.com/users/starius/}{@starius} are
\fpResultListing{TBB version ? on GNU/Linux\texttrademark\ by starius}{starius}{TBB @ Linux.partial.json}
These fingerprints are the same that he has got for IceWeasel.
\subsection{GNU/Linux\texttrademark\ distros for anonymous work}\label{linux-distros-for-anonymous-work}
As we see, the fingerprints depend on environment. One of the ways to solve this and a bunch of other problems is to use a GNU/Linux\texttrademark\ (or any other FOSS) system, specially designed for anonymous work.
I have tested \href{https://tails.boum.org/}{TAILS}\footnote{The Amnesic Incognito Live System}, open the HTML file from the repo, and \textbf{post your result as a comment} and \href{https://www.whonix.org/}{Whonix}.
Let's see what fingerprint TBB on TAILS gives us.
\fpResultListing{TBB 4.0.2 Tails (both on hardware and in VM)}{KOLANICH}{TBB, TAILS, Whonix/TBB 4.0.2 @ TAILS.json}
Then let's see a fingerprint of IceWeasel on Whonix
\fpResultListing{IceWeasel Whonix}{KOLANICH}{TBB, TAILS, Whonix/IW @ Whonix.json}
And, finally, TBB on Whonix
\fpResultListing{TBB Whonix}{KOLANICH}{TBB, TAILS, Whonix/TBB @ Whonix.json}
This matches \href{https://habr.com/post/356632/\#comment_8227810}{the partial results} obtained by \href{https://habr.com/users/starius/}{@starius}, and it is a good thing. Fingerprints of TBB and IceWeasel are not fully equal: there is 1 font more available in IceWeasel than in TBB. We can see a strong difference between fingerprints of TAILS, Whonix and TBB in different environments, and it is the bad thing. This means that an adversary can distinguish between TBB on different OS'es.
\subsection{GNU/Linux\texttrademark\ and fonts}\label{linux-and-fonts}
Let's check some GNU/Linux\texttrademark\ distro.
\fpResultListing{IceWeasel 24.7.0 on GNU/Linux\texttrademark}{KOLANICH}{Linux fonts/IW 24.7.0 @ Linux.json}
It doesn't match \href{https://habr.com/post/356632/\#comment_8227810}{the results} by \href{https://habr.com/users/starius/}{@starius}.
Then I have been installing into it some fonts copied from Win 8.1 to test whether I get the same fingerprint and observed a strange thing - font interdependence.
Firstly I have installed Consolas\texttrademark, which caused the changes in all fingerprints.
\fpResultListing{IceWeasel 24.7.0 on GNU/Linux\texttrademark\ with Consolas\texttrademark}{KOLANICH}{Linux fonts/IW 24.7.0 @ Linux + Consolas.json}
Then I have installed Constantia\texttrademark.
\fpResultListing{IceWeasel 24.7.0 on GNU/Linux\texttrademark\ with Consolas\texttrademark\ and Constantia\texttrademark}{KOLANICH}{Linux fonts/IW 24.7.0 @ Linux + Consolas + Constantia.json}
Then I have installed a bunch of fonts (except Times New Roman\texttrademark\ and Arial\texttrademark), which caused changes in all present fingerprints, except Consolas's\texttrademark. The most strange thing is that font Inconsolata mysteriously appeared though I haven't installed it (don't laugh, it wasn't copied from Windows\texttrademark).
\fpResultListing{IceWeasel 24.7.0 on GNU/Linux\texttrademark\ with bunch of Fonts}{KOLANICH}{Linux fonts/IW 24.7.0 @ Linux + Fonts.json}
Then I have installed Times New Roman\texttrademark, which caused total change \ldots{} Inconsolata mysteriously disappeared\ldots{}
\fpResultListing{IceWeasel 24.7.0 on GNU/Linux\texttrademark\ with bunch of fonts Fonts and Times New Roman\texttrademark}{KOLANICH}{Linux fonts/IW 24.7.0 @ Linux + Fonts + Times New Roman.json}
Then I have installed Arial\texttrademark, which only caused changes in itself and sans-serif.
\fpResultListing{IceWeasel 24.7.0 on GNU/Linux\texttrademark\ with bunch of Fonts and Times New Roman\texttrademark\ and Arial\texttrademark}{KOLANICH}{Linux fonts/IW 24.7.0 @ Linux + Fonts + Times New Roman + Arial.json}
Some offtop: during the study I have found that a large fraction of fonts contain a comment which has advices how the font was meant to be used. It's a pity that most of rich text editors (at least the ones on windows) don't show this comment in a tooltip.
\section{In The Wild}\label{in-the-wild}
After I have published this article (in Russian) a \href{https://trac.torproject.org/projects/tor/query?reporter=gk}{user gk from Tor Project's bug tracker} \href{https://trac.torproject.org/projects/tor/ticket/14310\#comment:3}{advised me an interesting article} \cite{Nikiforakis2014}. The article has meant some tracking scripts, at least \href{https://ds.bluecava.com/v50/AC/BCAC5.js}{Bluecava BCAC5.js} and \href{https://tags.master-perf-tools.com/V20test/tagv22.pkmin.js}{tagv22.pkmin.js} (which share the same implementation), where similar technique is used: they measure the length of some message to determine the list of font in system (and they don't send their fingerprints to server, only the font list). You can find a table of fingerprinting scripts in \cite{Acar2013,Acar2014}.
Later in TorProject bug-tracker one more script (\href{https://mathid.mathtag.com/device/id.js}{mathtag id.js}) using this technique \href{https://trac.torproject.org/projects/tor/ticket/13400#comment:15}{was mentioned}.
\section{Some offtop about randomization}\label{some-offtop-about-randomization}
In that article the authors suggest the way to randomize fingerprintable values to prevent tracking, but we have already seen how unsuccessful this kind of randomization is. I think that randomization for every site is useless because there is an obvious way to bypass it: to repeat tests and count statistics. If someone will follow the advice in the article and cache randomly generated values persistent for the same site then
\begin{itemize}
\itemsep1pt\parskip0pt\parsep0pt
\item
you can bypass it by inserting iframe of another domain but belonging to the same owner; in the case of canvas you can draw the same picture upon another picture, which cause the change in random noise so it can be discarded;
\item
you can use this cache as identifier;
\item
you can use this cache to DoS the browser just making browser generate infinitely many values and put them into the cache. This can be mitigated to setting a threshold and when the page exceeds the threshold then give it wrong values and drop the cache.
\end{itemize}
One of solutions is to use the same cache for all the sites, which is dropped in the end of the session. It won't kill tracking of the session, but won't allow creating a fingerprint persisting between sessions.
\section{3,5 Years later ...}\label{35anniversary}
I have rechecked the viability of this technique nearly 3,5 years later.
\begin{enumerate}
\item Firefox setting privacy.resistFingerprinting was introduced. It doesn't affect this method, with it true and false the fingerprints are the same. \fpResultFile{Firefox 62.0b6}{KOLANICH}{FF 62.0b6 @ Win 7.json} \fpResultFile{Firefox 63.0a1}{KOLANICH}{FF 63.0a1 @ Win 7.json}.
\item Tor Browser still exposes different fonts. \fpResultFile{Tor Browser 8.0a9}{KOLANICH}{TBB, TAILS, Whonix/TBB 8.0a9 @ Win 7.json}. Since there are not so many fonts shipped, they may be system fonts.
\item Tor Browser security level doesn't affect fingerprints.
\item the differences in fingerprints between different versions of browsers (FF 62.0b6 vs FF 63.0a1, and FF vs TBB, differences between TBB 7.5.6 and TBB 8.0a9 were not observed) on the same system still persist.
\item The countermeasures proposed have still not been implemented.
\item \href{https://github.com/brave/browser-laptop}{Brave web browser} has been tested. \fpResultFile{Brave 0.23.31}{KOLANICH}{Brave 0.23.31 (FP blocking mode) @ Win 7.json}. It has the mode for fingerprinting resistance. With this mode disabled the fingerprints are nearly identical to the ones produced by Chrome 67.0.3396.99 \fpResultFile{Chrome 67.0.3396.99}{KOLANICH}{Chrome 67.0.3396.99 @ Win 7.json}. When this mode is enabled the fingerprinter was detected as a fingerprinter and the fingerprints have been changed. Though this mode still allows font enumeration. The fingerprints are persistent across browsers restarts. Analysis of the source code showed that fonts fingerprinting via getBoundingClientRect does not trigger detection of fingerprinter and the fingerprints using only getBoundingClientRect are not affected by fingerprinting protection mode. It was confirmed by \href{https://github.com/brave/browser-laptop/wiki/Fingerprinting-Protection-Mode}{the info on the documentation page}. The bundle contains fonts, though it is yet to be verified whether they would give the same fingerprints on different systems.
Brave fingerprinting protection poses significant performance overhead, and it requires additional research if the delay is fingerprintable itself. Fingerprinting detection is implemented in JS and may be portable to other browsers.
Note: If you wanna test this fingerprinter on Brave, you need a web server since Brave for now doesn't open file:/// URIs.
\end{enumerate}
\section{Conclusions}\label{conclusions}
\begin{itemize}
\itemsep1pt\parskip0pt\parsep0pt
\item
The modified method doesn't allow to extract information about hardware, but still allows distinguish between OSes, browsers and fonts installed in system (and sometimes allows to extract info about other software because some software installs fonts into system, for example Microsoft\texttrademark\ Office\texttrademark\ installs Calibri\texttrademark\ font), it allows particularly both distinguish between different versions of TBB launched in the same environment and the same versions of TBB, launched in different environments.
\item
One of mitigations TBB devs are going to make is to use the fonts shipped with TBB exclusively, but this, most likely, won't help because different environments render the same text of same font differently. The browser version also influences this.
\item
Disabling JavaScript is a mandatory measure, at least you should disable fonts and most dangerous API using \url{about:config}. None of this was done neither in TAILS nor in TBB, which will cause a conspiracy theory appeared, especially if the one took in mind who \href{https://www.torproject.org/about/sponsors.htmml.en}{the sponsors of Tor Project} are and \href{https://www.youtube.com/watch?v=pRrFWwA-47U\&t=21m39s}{recommendations by some of their representatives} to execute
\lstinline!bash curl https://ooni.torproject.org/install.sh | bash!
, which is a known as a bad insecure practice because it runs the code from remote server on PC without checking, bypasses package manager and any time a malware can become available by such an address due bunch of different reasons, for example NSA can force the CA to issue a new certificate, make MiTM attack and spread malicious script. HTTP Public Key Pinning partly helps, but by the moment I was writing this article it \href{https://www.ssllabs.com/ssltest/analyze.html?d=torproject.org}{was not enabled on that server}.\\
Tails can be exclusion - because the fingerprint doesn't depend on hardware and users of the same versions have the same environments (without being Evil Buratino Yourself, of course), but don't forget that JS vastly increases attack surface for different exploits, including remote code execution ones. Disabling features can be detected, that's why we need them be disabled for all the users of actual versions. Post your ideas to \href{https://trac.torproject.org/}{Tor Project bug tracker}. You don't have to register: you can use the official shared account with the login \textbf{cypherpunks} and the password \textbf{writecode}.
\item
Disabling JS won't help because there are CSS (sophisticated technology of styling elements, allowing implementation of \href{https://github.com/you-dont-need/You-Dont-Need-JavaScript}{the things webmasters need without any line of JS} \href{https://github.com/i0z/nojsgame}{and even creating simple games without any line of JS code!}), using which it is also possible to extract info about computer, but this will make tracking a bit harder because CSS allows to extract less information than JS and it is harder to send it to server. Even if we disable CSS, there will be other holes. So, I don't think that disabling CSS will help much.
UPD: \href{https://github.com/jbtronics/CrookedStyleSheets}{A prototype of fingerprinter using CSS was developed}, just as expected and using the techniques expected. Can be mitigated by making a web browser to cache all the external resources on page load and use them from the cache.
\item
There is a strong need in \href{https://trac.torproject.org/projects/tor/ticket/14310}{a standard on anonymized browser behaviour}.
\item
Disabling JS is incompatible with highly commercialised the Web of today.\\
Business is business, if for making money (or not prosecuting and changing high ranked managers) it was necessary to collaborate with intelligence and law enforcement agencies, enlist itself into non secret or secret \href{https://97-fz.rkn.gov.ru/}{registry}, track users, analyse their actions and spread malware, this would be done. Pecunia non olet.\\
Some sites were intentionally made non-functional without JS, some of them have a note that they won't work without JS (but sometimes you can bypass it).\\
\textbf{The conclusion:} it seems that sites owner won't implement work without JS because it contradicts their interests.
UPD: There were the \href{https://www.vedomosti.ru/finance/articles/2018/06/21/773389-banki-proveryat-ustroistva}{news (though I haven't managed to find CB official document)} that the Central Bank of Russian Federation have mandated other Russian banks to do "analyze special and unique settings and parameters of devices" and take special attention to the clients having the same device fingerprints.
\end{itemize}
\section{Additional materials}\label{additional-materials}
\begin{enumerate}
\itemsep1pt\parskip0pt\parsep0pt
\item
\href{https://trac.torproject.org/projects/tor/ticket/13400}{Ticket about this question}
\item
\href{https://www.google.com/search?num=100\&newwindow=1\&q=getBoundingClientRect+browser+fingerprinting}{google(``getBoundingClientRect browser fingerprinting'')}
\item
\href{https://www.torproject.org/projects/torbrowser/design/\#fingerprinting-defenses}{Fingerprinting defenses in the Tor Browser}
\item
\href{https://gitlab.com/KOLANICH1/Article-2015-Dull-captaincy-or-the-way-Tor-Project-fights-browser-fingerprinting}{PoC and the repo of this article}
\item
\href{https://gitlab.com/KOLANICH1/Article-2015-Dull-captaincy-or-the-way-Tor-Project-fights-browser-fingerprinting/-/jobs/artifacts/master/raw/readme.en.pdf?job=build}{Copy of this article on GitLab.com as a build artifact}
\item
\href{https://jsfiddle.net/fyw4qmdg/5/}{The fiddle}
\end{enumerate}
\nocite{*}
\printbibliography[heading=bibnumbered]
\section{Updates}\label{updates}
\begin{enumerate}
\itemsep1pt\parskip0pt\parsep0pt
\item
Added the link to the fiddle.
\item
Added the fingerprints for Whonyx and Firefox on android and the
results by \href{https://habr.com/users/starius/}{@starius}.
\item
Added the links to the articles and ``In The Wild'' chapter
\item
\LaTeX\ English version. Text fixes. Separate folder with results.
\item
Discovered the paper\cite{Fifield2015} on the same topic with analysis of entropy of characters and fonts.
\item
Added info about mathid id.js and the \href{https://trac.torproject.org/projects/tor/ticket/13400#comment:12}{requested} fingerprints. Fixed the bibliography.
\item \begin{enumerate}
\item Fixed working on updated browsers;
\item removed now irrelevant notes about compatibility since now it is fixed;
\item added Fira Code and Fira Mono to the list of fonts to fingerprint;
\item added several fingerprints;
\item added some analytics;
\item replaced http:// with https://
\item now building with \XeTeX;
\item migrated to GitLab.com following aquisition of GitHub by Microsoft;
\item added GitLab CI and links to it;
\item improved and refactored fingerprinter code, disabled 10 passes for the browsers they are useless for;
\end{enumerate}
\end{enumerate}
{\footnotesize}
\appendix
\end{document}